# Security Policy

## Responsible Disclosure

To report a security vulnerability, please send a private email to `chris.christiansen@vauco.no`.

Do not include sensitive information, customer data, or secrets in public GitHub issues or chat discussions.

## Credential Security

- **NEVER** commit credentials, secrets, or tokens to the Git repository.
- **NEVER** include credentials in logs, frontend code, or any other uncontrolled files.
- If a credential is accidentally exposed, it **MUST** be rotated immediately.
- For production environments, all secrets must be stored in a dedicated secret management service (e.g., Google Secret Manager) and accessed using least-privilege IAM principles.